CVE-2024-4934: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2024-4934) affects the WordPress plugin Quiz and Survey Master (QSM) versions below 9.0.2. This stored Cross-Site Scripting (XSS) vulnerability allows users with contributor-level permissions and above to inject malicious scripts into quiz fields (WPScan).

The vulnerability stems from improper validation and escaping of Quiz fields before they are output back in pages or posts where the Quiz is embedded. The CVSS score is rated at 5.9 (medium severity), and it is classified as CWE-79. The vulnerability falls under the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan).

When exploited, this vulnerability allows authenticated users with contributor privileges or higher to perform Stored Cross-Site Scripting attacks by injecting malicious scripts into quiz answer fields, which are then executed when other users edit the affected posts (WPScan).

The vulnerability can be exploited by accessing the Quizzes & Surveys section, adding or editing a question on a Quiz, and inserting malicious JavaScript code in the answer field. The XSS payload gets triggered when any user edits the post containing the compromised Quiz (WPScan).

The vulnerability has been patched in version 9.0.2 of the Quiz and Survey Master plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).